L2 vault exploit losses reach $6M

TLDR

A multisig vault on Base, an Ethereum layer 2 network, was exploited for more than $6 million in wstETH, with the owner still unidentified.

1. About 1,783 wstETH was drained after an attacker whitelisted a new contract, borrowed Aave receipt tokens from the vault and redeemed them.
2. Base and Aave core contracts are not reported compromised, and the vault is controlled by an anonymous 3-of-7 Safe whose signers have not been disclosed.
3. Contagion looks limited, but the exploit exposes governance and whitelisting risks on L2 vaults and could add short term pressure to wstETH liquidity.

Deep Dive

1. Exploit Mechanics And Scale

Security firms and investigators report that a vault on Base was drained of roughly 1,783 wstETH, lifting losses from about $2.02 million to more than $6 million in under an hour, according to a detailed report on the vault attack on Base.

The attacker added a freshly created contract to the vaults whitelist, then borrowed aBaswstETH (Aave receipt tokens) from the vault and redeemed them through Aave on Base for around 1,783 wstETH, with six on chain outflows counted.

The precise authorization failure is still unconfirmed, but the pattern suggests a logic or governance weakness around who can update whitelists and borrow from the vault, rather than a flaw in the underlying L2 or money market.

2. Who Owns The Vault And What Was Not Hit

TokenPost notes that the vault is controlled by a Safe multisig set to require three of seven signers, yet none of the signers identities has been made public, and no project has claimed responsibility for the vault.

Both reports say Base itself and Aaves core contracts have not been identified as attacked, pointing the incident squarely at the vaults configuration and transaction approvals rather than the broader L2 or lending protocol.

3. Risk, Contagion And User Takeaways

Systemic contagion looks limited so far, but selling the stolen wstETH could create short term liquidity and price pressure in markets that use staked ETH derivatives as collateral or yield assets.

For DeFi users, the incident highlights the importance of transparent multisig governance, clear documentation of vault owners, and careful monitoring of privileged actions like contract whitelisting and borrow permissions on L2s.

From a risk lens, opaque custodial structures and unexplained authority over large vaults are a red flag, especially when they can approve new contracts or move large positions without public oversight.

Conclusion

The Base vault exploit is a targeted failure in a custom, anonymously controlled multisig rather than a direct break of Base or Aave, but it still removed more than $6 million in value in minutes.

For crypto users and builders, the main lesson is that security and governance around vaults and multisigs are as critical as the security of the L2 and lending protocols beneath them, and that opaque control over large pools of collateral is a structural risk that deserves close attention.